2026-11-09 22:41:50 +00:00
1 changed files with 3 additions and 0 deletions
@@ -164,11 +164,14 @@ Cost: the job shares the single act_runner slot with the gate, but the build its
 .gitea/workflows/
  merge-gate.yaml            the pipeline (lint → l0 → l1 → conformance → decision)
  images.yaml                build/verify/publish this repo's container images (see above)
+  cve-triage.yaml            scheduled CVE triage bot (R-VULN-05/07, ADR-0027; runs before Renovate)
  scripts/
    install-tools.sh         installs the pinned tools per stage (from ci/versions.env) — used by the
                             dormant merge-gate.yaml blueprint only; gate.yml runs in the toolbox image
    decide.sh                the R-TEST-03 merge decision over job results
    images.sh                the image pipeline's driver (what to build, base, push, digest)
+    cve_triage.py            the CVE triage bot: reads the scanner report, maintains the counts-only
+                             CVE Dashboard issue, ticks Renovate approval rows (cve-triage.yaml)
  README.md                  this file
 ```